Git is a fast, scalable, distributed revision control system with an unusually rich command set that provides both high-level operations and full access to internals. The wincred credential helper uses a static buffer (target) as a unique key for storing and comparing against internal storage. This credential helper does not properly bounds check the available space remaining in the buffer before appending to it with wcsncat(), leading to potential buffer overflows. This vulnerability is fixed in v2.43.7, v2.44.4, v2.45.4, v2.46.4, v2.47.3, v2.48.2, v2.49.1, and v2.50.1.
CVSS Details
- CVSS 3.1 Base Score: 6.3
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade git | Aug 8, 2025 | Jul 8, 2025 |
| Debian | — | No solution exists | Jul 10, 2025 | Jul 8, 2025 |
| Freebsd | — | Upgrade git-p4Upgrade gitUpgrade git-svnUpgrade git-cvsUpgrade git-gui | Jul 9, 2025 | Jul 8, 2025 |
| Gentoo Linux | — | Upgrade dev-vcs/git. | Jul 9, 2025 | Jul 8, 2025 |
| Huawei Euleros 2_0_sp13 | — | Upgrade git-coreUpgrade git-helpUpgrade git | Oct 24, 2025 | Oct 23, 2025 |
| Microsoft Visual_studio | — | Update Microsoft Visual Studio 2022 to the latest version in the LTSC 17.8 version stream, or upgrade to a newer supported version of Visual Studio 2022.Update Microsoft Visual Studio 2017 to the latest version in the LTSC 15.9 version stream, or upgrade to a newer supported version of Visual Studio 2017.Update Microsoft Visual Studio 2019 to the latest version in the LTSC 16.11 version stream, or upgrade to a newer supported version of Visual Studio 2019.Update Microsoft Visual Studio 2022 to the latest version in the LTSC 17.10 version stream, or upgrade to a newer supported version of Visual Studio 2022.Update Microsoft Visual Studio 2022 to the latest version in the current channel channel.Update Microsoft Visual Studio 2022 to the latest version in the LTSC 17.12 version stream, or upgrade to a newer supported version of Visual Studio 2022. | Jul 10, 2025 | Jul 8, 2025 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Jul 8, 2025 |
| Suse | — | Upgrade perl-GitUpgrade git-guiUpgrade git-daemonUpgrade git-archUpgrade git-coreUpgrade git-docUpgrade git-emailUpgrade git-webUpgrade git-p4Upgrade gitUpgrade git-credential-libsecretUpgrade gitk | Dec 5, 2025 | Sep 22, 2025 |
| Ubuntu | — | Upgrade gitkUpgrade gitUpgrade git-gui (Ubuntu Pro)Upgrade git (Ubuntu Pro)Upgrade git-guiUpgrade gitk (Ubuntu Pro) | Jul 9, 2025 | Jul 8, 2025 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Aug 19, 2025 | Jul 8, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub